Insecure Direct Object Reference Vulnerability in Kirki Page Builder Plugin for WordPress
CVE-2026-107762

7.5HIGH

Key Information:

Vendor

WordPress
Status
Kirki – Freeform Page Builder, Website Builder & Customizer
Vendor
CVE Published:
17 October 2026

What is CVE-2026-107762?

The Kirki Page Builder plugin for WordPress is susceptible to Insecure Direct Object Reference due to inadequate validation of the 'context' parameter. This flaw allows unauthenticated attackers to retrieve sensitive profile information of arbitrary users including their email address, display name, and custom meta information via REST API responses. The risk of exploitation arises when a page using Kirki templates with dynamic user content is publicly available, as WordPress REST endpoints can expose target user IDs, making it easy for attackers to access the sensitive data.

Affected Version(s)

Kirki – Freeform Page Builder, Website Builder & Customizer 0 <= 6.3.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/kirki/tags/6.3...
https://plugins.trac.wordpress.org/browser/kirki/tags/6.3...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Md. Moniruzzaman Prodhan (NomanProdhan)
.